Decision 146/2009 Professor Allyson Pollock and the Scottish Ministers

Contract for the Scottish Patient Experience Programme Technical Partner

Reference No: 200801327
Decision Date: 17 December 2009

Summary

Professor Pollock requested from the Scottish Ministers (the Ministers) a copy of the contract between the Scottish Government and PricewaterhouseCoopers LLP (PwC) for the "Scottish Patient Experience Programme Technical Partner". The Ministers responded by providing the information subject to redaction under sections 33, 36 and 38 of the Freedom of Information (Scotland) Act 2002 (FOISA). Following a review, Professor Pollock remained dissatisfied and applied to the Commissioner for a decision.

Following an investigation, the Commissioner found that the Ministers, while withholding certain information correctly under sections 33(1)(b), 36(2) and 38(1)(b) of FOISA, had partially failed to deal with Professor Pollock's request for information in accordance with Part 1 of FOISA.In particular, by incorrectly applying section 38(1)(b) to the personal data of key senior employees of PwC responsible for the provision of the service, and sections 33(1)(b) and 36(2) to previous project engagement descriptions, the Ministers failed to comply with Part 1 and particular section 1(1) of FOISA.He required the Ministers to provide Professor Pollock with this information.

Relevant statutory provisions and other sources

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and 1(6) (General entitlement); 2(1) and (2)(c) and (e)(ii) (Effect of exemptions); 33(1)(b) and (2)(b) (Commercial interests and the economy); 36(2) (Confidentiality), and 38(1)(b), (2)(a)(i) and (b) and (5) (definitions of data protection principles, data subject and personal data) (Personal information)

Data Protection Act 1998 (the DPA) sections section 1(1) (Basic interpretative provisions) (definition of personal data); Schedules 1 (The data protection principles) (the first principle) and 2 (Conditions relevant for purposes of the first principle: processing of any personal data) (condition 6)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.

Background

1.On 8 February 2008, Professor Pollock wrote to the Ministers requesting the following information:

A copy of the contract between the Scottish Government (Scottish Government Procurement Directorate) and PricewaterhouseCoopers LLP for the "Scottish Patient Experience Programme Technical Partner", contract number HCC/000/19 awarded on 14 December 2007

2.The Ministers responded on 7 March 2008.They supplied some of the information but withheld the remainder on the basis that sections 33, 36 and 38 of FOISA applied.

3.On 28 March 2008, Professor Pollock wrote to the Ministers requesting a review of their decision.In particular, Professor Pollock submitted to the Ministers that it was in the public interest to be able to evaluate the claims made by PricewaterhouseCoopers (PwC) in the tender and contract documents with respect to expertise, capacity and capability and value for money, these being key requirements of the tendering process, pointing out that not all of this information had been released.

4.The Ministers notified Professor Pollock of the outcome of their review on 30 April 2008, upholding their original decision without amendment.

5.On 4 September 2008, Professor Pollock wrote to the Commissioner, stating that she was dissatisfied with the outcome of the Ministers' review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

6.The application was validated by establishing that Professor Pollock had made a request for information to a Scottish public authority and had applied to the Commissioner for a decision only after asking the authority to review its response to that request.

Investigation

7.On 24 September 2008, the Ministers were notified in writing that an application had been received from Professor Pollock and asked to provide the Commissioner with any information withheld from her. The Ministers responded with the information requested and the case was then allocated to an investigating officer.

8.The investigating officer subsequently contacted the Ministers, giving them an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking them to respond to specific questions.In particular, the Ministers were asked to justify their reliance on any provisions of FOISA they considered applicable to the information requested.

9.During the course of the investigation, the Ministers reassessed some of the information withheld and released further information which was originally withheld to Professor Pollock.

10.Information made available to Professor Pollock can be accessed on the Scottish Government's website at: http://www.scotland.gov.uk/About/FOI/Disclosures/2008/07/material

11.Professor Pollock was asked to comment on this additional release and whether she wished to continue with her application to the Commissioner.She replied stating that she wished to continue with her application and that her concerns now fell into three distinct categories as set out below:

Costs: costing information continued to be withheld from the "Revised Pricing Schedule", although that appeared inconsistent given the information released

Previous contracts: she believed this information to be necessary to verify PWC's claim of relevant experience and noted that equivalent information had been released in relation to similar English NHS contracts

Identity and CV's: also to verify relevant experience, she considered it necessary to know at least who the relevant individuals were.Again, she noted that this detail was available for English contracts.

Given these specific concerns, the Commissioner will not consider further the Ministers earlier withholding of the information released in the course of the investigation.In addition, he does not consider it necessary to include document 5 (the insurance indemnity certificate), which contains no information falling into any of the above three categories, within the scope of his investigation.

12.Clarification was obtained from the Ministers on certain aspects of the case.The relevant arguments put forward by both the Ministers and Professor Pollock will be considered fully in the Commissioner's analysis and findings below.

Commissioner's analysis and findings

13.In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the submissions made to him by both Professor Pollock and the Ministers and is satisfied that no matter of relevance has been overlooked.

Background

14.Better Together is NHS Scotland's Patient Experience Programme, which aims to gather and act upon information from patients and carers about their experiences of health services in order to improve services in the future.

15.In August 2007, an invitation to tender (ITT) was issued to commission a contractor, to be known as the Scottish Patient Experience Programme's Technical Partner, to help develop and run the central component of the Programme for Scotland.In response to the ITT, five tenders were received and, following a tender assessment exercise and interviews with potential candidates, the contract was awarded to PwC on 14 December 2007 and came into effect on 1 January 2008.

16.In response to Professor Pollock's request of 8 February 2008, details about the contract were made available on the Scottish Government's website.Published information included the proposed approach to and timetable for the work, as well as overall cost details.Further information was made available on the website during the course of the investigation.

17.The current contract is in place for three years with a possible one year extension.

Documents 1a (successful tender) and 1b (annexes to successful tender)

18.From document 1a, the relevant information redacted by the Ministers was that giving the names of individual employees of PwC, details of other clients, details of referees and allocations of staff time (insurance details were also redacted, but (for the reasons given in paragraph 11 above) are not considered relevant to this investigation).From document 1b, the CVs of individual employees of PwC have been redacted, although the general functions of each team were released during the course of the investigation.Previous client details and the relative engagement descriptions were also redacted from this document, along with other selected details of past projects.

19.During the course of the investigation, the Ministers clarified that they were applying section 38(1)(b) only to the redacted information from these documents relating to PwC employees, while section 33(1)(b), 33(2)(b) and 36(2) was applied to the remaining redactions.Section 38(1)(b) (only) was also applied to the information withheld from document 4 (contract award letter) and will be considered further at the end of this decision.

Section 36(2) ? confidentiality

20.Section 36(2) of FOISA provides that information is exempt if it was obtained by a Scottish public authority from another person (including another such authority) and its disclosure by the authority so obtaining it to the public (otherwise than under FOISA) would constitute a breach of confidence actionable by that person or by any other person.Section 36(2) is an absolute exemption and is not, therefore, subject to the public interest test in section 2(1)(b) of FOISA, but it is generally accepted in common law that an obligation of confidence cannot apply to information the disclosure of which is necessary in the public interest.

21.Section 36(2), therefore, contains a two stage test, both elements of which must be fulfilled before the exemption can be relied upon. Firstly, the information must have been obtained by a Scottish public authority from another person. "Person" is defined widely and includes another individual, another Scottish public authority or any other legal entity, such as a company or partnership.

22.The Ministers argued that the information central to the request had been obtained by them from another person, in this case PwC.Having considered the withheld information and the circumstances of its provision, the Commissioner accepts this and consequently considers the first part of the test to be met.

23.The second part of the test is that the disclosure of the information by the public authority would constitute a breach of confidence actionable either by the person who gave the information to the public authority or by any other person. The Commissioner takes the view that "actionable" means that the basic requirements for a successful action must appear to be fulfilled.

24.There are three main requirements which must be met before a claim for breach of confidentiality can be established to satisfy the second element to the test. These are:

the information must have the necessary quality of confidence;

the public authority must have received the information in circumstances which imposed an obligation on the authority to maintain confidentiality; and

there must be a disclosure which has not been authorised by the person who communicated the information but which would cause damage to that person.

25.The Ministers considered that disclosure of the information obtained from PwC would constitute a breach of confidence actionable by PwC (and possibly other persons referred to within the information itself).

26.The Ministers acknowledged that the ITT (available at http://www.scotland.gov.uk/Resource/Doc/923/0063837.pdf) contained clear statements alerting potential tenderers to the fact that all information submitted to the Ministers might need to be disclosed, with explicit reference to FOISA.However, they also considered it clear from the tender submitted by PwC that the information provided was copyright and considered to be confidential to PwC.

27.The Ministers contended that, almost by definition, given the nature and context of the information (i.e. material included in tender documents) the necessary quality of confidence was present.In particular, they highlighted pricing and payment schedules and references to clients.Furthermore, they submitted that none of the information was generally publicly available and that much of it was of a sensitive and sometimes personal nature.They suggested that references to clients would only have been provided with the client's consent, pointing out that PwC had made it very clear that its clients had permitted their details to be used in confidence and purely in the context of PwC tendering for other contracts.

28.In terms of the obligation of confidence, the Ministers submitted that the information had been provided explicitly in terms of confidence.They argued that, although clauses in the ITT referred to the possibility that information might be published, this was clearly not a statement that information would be published: in respect of the application of any FOISA exemption, a full analysis was still required.The Ministers were also strongly of the view that the inherent nature of the tendering process implied an obligation of confidentiality.In particular, given the close proximity of the time of the request (8 February 2008) to the preparation and award of contract (14 December 2007), the Ministers contended the obligation of confidentiality would still have been relevant.

29.The Ministers also believed unauthorised disclosure of the information would be to the detriment of PwC, not only in terms of this particular tender, but also in terms of potentially tendering for contracts in future.While not providing copies of the related correspondence, the Ministers stated that PwC had clearly not consented to the release of the information remaining withheld.Fundamentally, the Ministers submitted, the withheld information contained data unique to PwC, particularly in terms of pricing structures, release of which could clearly damage PwC and assist their competitors by revealing positions they might well wish to adopt in future contract negotiations.

30.Contrary to what the Ministers have stated in their submissions, the Commissioner has not been able to identify an explicit obligation of confidentiality in the tender documents.Furthermore, paragraph 1.1.5. of the Invitation to Tender (ITT) specifically states:

"? if you consider that any of the information included in your bid is commercially confidential please identify it and explain (in broad terms) what harm might result from disclosure and/or publication.It should be remembered though, that, even where you have indicated that information is commercially sensitive, Scottish Ministers may disclose this information where they see fit.Receipt by the Scottish Ministers of any material marked "confidential" or equivalent should not be taken to mean that the Scottish Ministers accept any duty of confidence by virtue of that marking."

No record has been produced by the Ministers of any of the withheld information having been so identified.

31.The Commissioner accepts, however, that the inherent nature of the tendering process implies an obligation of confidentiality with respect to certain types of information relating to that process, at least at the time of submission of tenders and their evaluation by the commissioning authority.

Previous project/client details/ engagement descriptions ? redactions from document 1b and 1a

32.The Ministers relayed PwC's view that details of other clients were made available solely for the purposes of proposal evaluation.PwC had stated that their clients gave permission for this usage only ? and not to be made publicly available.PwC had also suggested that disclosure of such information would damage the trusted relationships with their clients and (potentially) the willingness of those clients to be quoted in future proposals, which in turn could damage its ability to compete for future work to the best of its ability.

33.The nature and content of this information has been considered closely by the Commissioner and when read in context he is not satisfied that it has the necessary quality of confidence.The information in question provides a very general description of the objectives of each project and a brief history outlining the need for the project, neither of which the Commissioner can describe as requiring any degree of secrecy ? in fact, in most instances the outcomes of each project are already in the public domain.The Commissioner also notes that the project engagement descriptions readily allow the client in question to be identified.The Commissioner has considered the nature of the clients in question and cannot accept that they would have a reasonable expectation that knowledge of their engagement of PwC would be confidential: furthermore, the Commissioner, despite requesting submissions in this regard, has not received any evidence to suggest that the clients in question regard this information as confidential.The Commissioner therefore concludes that such information cannot be considered to have the necessary quality of confidence.

34.The information withheld in this case has also been considered closely by the Commissioner in the context of the timing of Professor Pollock's request and its handling by the Ministers.He is not satisfied that all of the information withheld could be regarded as confidential once the tender process had been completed.In this instance, the tender process was over at the time of Professor Pollock's request, the contract had been awarded and the Commissioner takes the view that any expectations of confidentiality must reduce as a consequence.In particular, the Commissioner does not accept that details of previous projects and client details retained the necessary quality of confidence in such circumstances.The Commissioner cannot therefore accept that, at the time the Ministers dealt with Professor Pollock's request for review, the withheld project and client information could properly be considered confidential and held solely for the purposes of tendering.

35.In all the circumstances, therefore, the Commissioner concludes that the Ministers were incorrect in their application of section 36(2) in respect of previous project and client details.

36.However, the Ministers also applied section 33(1)(b) and 33(2)(b) to this information, the consideration of which is set out below.

Referees and allocations of staff time ? document 1a

37.The Commissioner accepts that the inherit nature of the referee contact details have the necessary quality of confidence as they would not have an expectation that this information would be disclosed any further.

38.The Commissioner is also satisfied that the tables that convey PwC methodology, in particular how PwC allocate their resources (i.e. staff time) had the necessary quality of confidence, at least at the time the Ministers dealt with Professor Pollock's request.

39.He is also satisfied that the above information was received by the Ministers in circumstances which imposed an obligation on them to maintain confidentiality.

40.As indicated above, the third requirement of an actionable breach of confidence is that there must be a disclosure which has not been authorised by the person who communicated the information but which would cause damage to that person.

41.The tender from PwC contains (included in the copyright statement on page 3) the following statement:

"In the event that, pursuant to a request which the Scottish Executive ("SE") has received under the Freedom of Information (Scotland) Act 2002 ? the Executive is required to disclose any information contained in this proposal, it will notify PwC promptly and will consult with PwC prior to disclosing such information."

42.During the course of the investigation, the Ministers explained that they had consulted with PwC on receipt of the request and again at appeal stage.In response, PwC had specifically highlighted various commercial interests of concern.In relation to their methods and approaches, PwC considered release might cause damage through (a) enabling competitors to replicate their approaches and (b) providing competitive insights that damaged PwC's ability to effectively compete in future procurements.PwC considered this information to remain sensitive for the foreseeable future.

43.The Minsters stated that, while paying due regard to the views of PwC, they acknowledged that, as the public authority, final responsibility for dealing with the request lay with them.They did not consider themselves able to forward copies of any relevant correspondence with PwC, which they considered by definition related to their own internal processes: they would wish to protect the private space in which they could consider their position with contractors.

44.The Commissioner has reviewed the information in question and acknowledges that the details convey information which is commercially sensitive and unique to PwC.Given the timing of the request, the Commissioner accepts that disclosure of this information could have resulted in the requisite degree of damage for an actionable breach of confidence to occur.

45.As stated above, if the conditions of section 36(2) are fulfilled, an absolute exemption is created. However, it is generally accepted in common law that an obligation of confidence cannot apply to information the disclosure of which is necessary in the public interest.

46.The exemption in section 36(2) is not, however, subject to the public interest test in section 2(1) of FOISA. The law of confidence recognises that there is a strong public interest in ensuring that people respect confidences, and the burden of showing that a failure to maintain confidentiality would be in the public interest is therefore a heavy one. However, in certain circumstances, the public interest in maintaining confidences may be outweighed by the public interest in disclosure of information. In deciding whether to enforce an obligation of confidentiality, the courts are required to balance these competing interests, but there is no presumption in favour of disclosure (Decision 056/2006 MacRoberts and the City of Edinburgh Council).

47.The courts have considered that there may be a public interest defence to actions of breach of confidentiality where to enforce an obligation of confidence would, for example, cover up wrongdoing, allow the public to be misled or unjustifiably inhibit public scrutiny of matters of genuine public concern.In this instance, Professor Pollock submitted that previous contract information was necessary to verify PwC's claim of relevant experience.

48.The Commissioner has considered whether disclosure of the information in question would be necessary to secure effective scrutiny of decision-making processes or oversight of the expenditure of public funds. Taking into account the information already released by the Ministers, which includes cost schedules covering the 3 year period, the Commissioner sees no reasonable basis for concluding that the Ministers would have a defence to an action of breach of confidence on public interest grounds should they disclose these details.

49.The Commissioner therefore concludes that the Ministers were correct in their application of section 36(2) of FOISA to the referee details and the cost schedules at the time of Professor Pollock's request.

Section 33(1)(b) and 33(2)(b) ? Commercial interests and the economy ? previous clients and project engagement descriptions

50.Section 33(1)(b) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, prejudice substantially the commercial interests of any person (the definition of 'person' includes a public authority). This is a qualified exemption, and is subject to the public interest test required by section 2(1)(b) of FOISA.

51.In the Commissioner's view, there are certain elements to section 33(1)(b) of FOISA which an authority needs to demonstrate when relying on this exemption.In particular, it needs to indicate whose commercial interests would or would be likely to be harmed by disclosure, the nature of those commercial interests and how those interests would, or would be likely to, be prejudiced substantially by disclosure.Where an authority is arguing that the commercial interests of a third party will be harmed, the authority should make this clear and should indicate the nature of those commercial interests and how these interests would, or would be likely to, be substantially prejudiced.The prejudice must be substantial (in other words, of real and demonstrable significance) and it must be at least likely, in the sense that there must be a significant probability of it occurring.

52.Even where an authority considers that section 33(1)(b) of FOISA applies to information which is the subject of the request, it must still go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by that in maintaining the exemption.

53.The Ministers argued that disclosure of the information would be likely to substantially prejudice the commercial interests of both the Scottish Government and, more directly, PwC.They explained that the information on which this request focuses was clearly specific to PwC and consisted of sensitive commercial, financial and personal information prepared solely for the reasons of submitting a tender for a commercial contract.The tender, the Ministers argued, and in particular the appendices (document 1b) set out detailed information on the approach taken by PwC and contained analysis of PwC techniques, statements on technical ability and capacity, commercial referees, references to specific projects with particular clients, pricing schedules and costs, and details of PwC employees.The Ministers argued that, at the time of the request, which came a few weeks after the contract came into effect, the information was still current and contended that as part of a "live" contract it should continue to be considered current.

54.Given the currency of the information at the time of the request, the Ministers contended that further release would be likely to substantially prejudice the commercial interests of PwC by a) enabling competitors to replicate their approaches, thereby undermining the investment made and b) provide competitive insights that damaged their ability to effectively compete in future procurements.

55.Finally, the Ministers submitted that PwC had made available details of other clients solely for the purpose of proposal evaluation and not in any expectation that the information would be made publicly available.The Ministers argued that the disclosure of such information could substantially prejudice the trusted relationship PwC had established with clients.This would impact both on future businesses with the clients and on their willingness to be quoted in future proposals.

56.In considering the information withheld from documents 1a and 1b, the Commissioner has taken account of the timing of Professor Pollock's request.In this instance the contract was awarded on 14 December 2007 and the request was made some two months after this date on 8 February 2008.Although the Commissioner recognises that some information of a particular nature can retain a degree of commercial sensitivity during the tendering process and for a limited time once the contract has been awarded, he does not accept that this necessarily applies to all information.

57.The information withheld in this instance has been considered closely by the Commissioner, taking full account of the timing of the request.He is not satisfied that all of the information withheld could be regarded as retaining the requisite degree of commercial sensitivity, following completion of the tender process.In this instance the tender process had been completed at the time of Professor Pollock's request and the contract had been awarded. The harm envisaged by the Ministers is in respect to potential future tenders (the Ministers have not alerted the Commissioner to any specific contracts for which PwC is or proposes tendering).In the circumstances, the Commissioner does not accept that details of previous project engagement descriptions and the identity of the clients has commercial sensitivity such that disclosure would damage substantially PwC's ability to tender for future projects.In reaching this conclusion, the Commissioner has not found there to be any benefit tocompetitors who, on becoming aware of the information withheld, might seek to replicate the approach of PwC in setting out past experience and relationships with clients in their own tenders.Nor does the Commissioner accept that relationships with clients would be affected if the brief details of the clients and projects involved in this application were to be disclosed.He does not accept that disclosure would cause the clients to require such information to be withheld from such tenders in future.The Commissioner therefore concludes that the Ministers were incorrect in their application of section 33(1)(b) of FOISA to this information.As a result, he is not required to go on to consider the public interest test.

58.The Ministers also applied section 33(2)(b) of FOISA to this information.Section 33(2)(b) states that information is exempt if its disclosure would, or would be likely to, prejudice substantially the financial interests of an administration in the United Kingdom.The Scottish Administration is "an administration in the United Kingdom" for these purposes.The requirements as to the risk and level of harm required are basically the same as for the exemption in section 33(1)(b) (see paragraph 51 above).

59.The Ministers considered that the release of this information would substantially prejudice the financial interest of the Scottish Government (and therefore the Scottish Administration) in terms of limiting the ability of the Ministers to engage with private sector service providers on an equitable basis as well as potentially discouraging private sector service providers from entering into commercial partnerships with them.This, the Ministers argued, might adversely impact more generally on their corporate reputation and their ability to attract suitable competition from the market and hence value for money for the Scottish taxpayer.

60.On the basis of the arguments presented to him, the Commissioner cannot accept that disclosure of this information would, or would be likely to, prejudice substantially the financial interests of the Scottish Administration.In reaching this conclusion, the Commissioner can establish no reasonable link between the nature of the information in question and the harm suggested by the Ministers or the harm this exemption is designed to avert.While accepting that a significant breakdown in the Ministers' ability to procure goods or services on competitive terms could be substantially detrimental to the financial interests of the Administration, he is not persuaded that disclosure of this information would be remotely likely to have that effect.In this connection, he notes the information's relative lack of commercial sensitivity, as indicated above in relation to section 33(1)(b) of FOISA.The Commissioner therefore concludes that the Ministers were incorrect in their application of section 33(2)(b) of FOISA, and consequently he is not required to consider the public interest test.He has not considered the Ministers' application of section 33(2)(b) to any other withheld information, as he has found that information to have been correctly withheld under other exemptions.

Documents 2 (revised pricing schedule) and 3 (payment schedule) ? section 33(1)(b)

61.The Ministers also applied section 33(1)(b) to the revised pricing schedule and payment schedule.During the course of the investigation, further information, which had originally been withheld, was disclosed by the Ministers.However, the Ministers continued to withhold from these documents details of staff time allocation and annual costs, along with insurance details (which, for the reasons stated above, are not considered relevant to this investigation).

62.The Ministers submitted that disclosure of this information would be likely to substantially prejudice the commercial interests of both the Ministers and more directly PwC. The Ministers arguments as to prejudice are set out above, in relation to the other documents considered under section 33(1)(b).

63.The Commissioner is satisfied that the detailed pricing schedule (incorporating a schedule of staff allocation) is a key component to PwC's methodology.Given the timing of the request and the specific nature of the information in question (i.e. the ability of competitors to replicate the information in question), the Commissioner is satisfied that the information retained the quality of commercial confidence at that time and that the Ministers were correct to conclude that its disclosure would, or would be likely to, prejudice substantially the commercial interests of PwC.

64.The Commissioner therefore concludes that the Ministers were correct in their application of section 33(1)(b) of FOISA to the details remaining redacted from the revised pricing schedule.

65.The Ministers have also withheld PwC's indicative payment schedule.Having considered this document, the Commissioner is satisfied that it conveys PwC's pricing structure, along with elements of their understanding of the Ministers' requirements which formed key parts of the methodology in their tender.The Commissioner therefore accepts that this information, if disclosed at the time of the request or request for review, would have prejudiced, or would have been likely to prejudice, substantially the commercial interests of PwC.In reaching this conclusion the Commissioner has taken account of the timing of the request, which for these purposes he considers relevant.However, the Commissioner notes that the commercial sensitivity of this particular information may be likely to diminish over time, particularly as the schedule appears to be indicative only and the project is now in its second year.

66.The Commissioner therefore concludes that the Ministers were correct in their application of section 33(1)(b) of FOISA to documents 2 and 3 at the time of dealing with Professor Pollock's request.

67.As the Commissioner is satisfied that the Ministers were correct in their application of section 33(1)(b) of FOISA, he is required to go on and consider the application of the public interest test as set out in section 2(1)(b) of FOISA.This involves assessing whether, in all the circumstances of the case, the public interest in maintaining the exemption outweighs that in disclosure of the information.

68.The Ministers acknowledged a general public interest in the disclosure of information relating to tenders involving public authorities and therefore public money.However, they also argued that there was a public interest in safeguarding the fairness of the tendering process.To the Ministers, there was little doubt that release of what they considered to be commercially sensitive information ? unique to particular contracts and contractors ? would impact on the ability of the contractor to engage in the contract process.

69.The Ministers also highlighted that a significant amount of information concerning the Scottish Patient Experience Programme was already in the public domain and provided significant details about the proposed methods and approaches as well as financial data.They submitted that the disclosure of further information would undermine the commercial position of PwC and that this would be against the public interest.

70.Although no specific arguments were forwarded by Professor Pollock with regard to the public interest test, she did indicate why she considered disclosure of the withheld information to be necessary, as set out in paragraph 11 above.The Commissioner recognises the importance of transparency in the decision-making process, particularly where it relates to the expenditure of public funds.Having reviewed the information provided to Professor Pollock, he is not satisfied that these public interest purposes could be furthered significantly by the provision of the information remaining withheld.The Commissioner is therefore satisfied, having taken all the circumstances into account, that the public interest in maintaining the exemption outweighs that in disclosure.The Commissioner therefore concludes that the Ministers were correct in withholding the information in documents 2 and 3 under section 33(1)(b) of FOISA.

Consideration of section 38(1)(b) ?documents 1a, 1b and 4

71.The Ministers applied section 38(1)(b) to information which identified PwC employees, in documents 1a, 1b and 4.

72.The exemption under section 38(1)(b) of FOISA, read in conjunction with section 38(2)(a)(i) or (as appropriate) section 38(2)(b), provides that information is exempt information if it constitutes personal data (as defined in section 1(1) of the DPA) and its disclosure to a member of the public otherwise than under FOISA would contravene any of the data protection principles contained in the DPA.This is an absolute exemption and therefore is not subject to the public interest test laid down by section 2(1)(b) of FOISA.

73.In order for a public authority to rely on this exemption, it must show firstly that the information which has been requested is personal data for the purposes of the DPA, and secondly that disclosure of the information would contravene at least one of the data protection principles laid down in the DPA.

74.The Ministers submitted that much of the withheld information consisted of the career experience and educational history of PwC employees.They considered such information to be personal data in a significant biographical sense and that as such section 38(1)(b) applied.The Ministers also considered that this exemption applied to individual names throughout the various documents, including personal signatures.

75.The Ministers did not consider that processing (by disclosure) would be either fair or lawful and therefore submitted that it would contravene the first data protection principle.They submitted that of the six Conditions for Processing, as set out in Schedule 2 of the DPA, only the sixth was of relevance but in practice was not met.The Ministers contended that even were the processing necessary for the purposes of any legitimate interest, it would be prejudicial to the rights and freedoms or legitimate interests of the particular individuals involved.

76.The Ministers explained that the personal details contained in the documentation were supplied by PwC, in the context of a contract tender, in terms of confidentiality.In respect of the fairness of processing, the Ministers took into account not only how this information was obtained but also the expectations of the individuals concerned as to disclosure.They submitted that none of the data subjects would have any expectation that information personal to their careers and education ? or their salaries ? would be made publicly available.

Is the information personal data?

77.When considering the exemption in section 38(1)(b) of FOISA, the Commissioner must first establish whether the information withheld is personal data.Personal data is defined in section 1(1) of the DPA as data which relate to a living individual who can be identified from those data, or from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller (the definition is set out in full in the Appendix).

78.The Commissioner is satisfied that the information redacted from these documents is personal data.It is information relating to named individuals who can be identified from those data.It describes their previous activities, clearly focuses on them and is biographical of them in a significant sense.Consequently, it relates to them.

Would disclosure breach the first data protection principle?

79.As noted above, the Ministers argued that disclosure in this case would breach the first data protection principle.

80.The first data protection principle requires that the processing of personal data (in this case, the disclosure of data in response to a request made under FOISA) must be fair and lawful and, in particular, that personal data shall not be processed unless at least one of the conditions in Schedule 2 (to the DPA) is met. For sensitive personal data, at least one of the conditions in Schedule 3 to the DPA must also be met. The Commissioner has considered the definition of sensitive personal data set out in section 2 of the DPA, and he is satisfied that the personal data under consideration in this case does not fall into any of these categories.It is therefore not necessary to consider the conditions in Schedule 3 in this case.

81.There are three separate aspects to the first data protection principle: (i) fairness, (ii) lawfulness and (iii) the conditions in the schedules.However, these three aspects are interlinked.If there is a specific condition which permits the personal data to be disclosed, it is likely that the disclosure will also be fair and lawful.

82.The Commissioner will now go on to consider whether there are any conditions in Schedule 2 to the DPA which would permit the personal data to be disclosed and whether the disclosure of this personal data would be fair and lawful.

Can any of the conditions in Schedule 2 of the DPA be met?

83.The Ministers have argued that of all the conditions in Schedule 2 of the DPA, only the sixth might permit disclosure of the personal data in this case.

84.The Commissioner has considered all of the conditions in Schedule 2 of the DPA, and shares the view that condition 6 of Schedule 2 to the DPA is the only condition which might be considered to apply in this case.Condition 6 allows personal data to be processed (in this case, disclosed in response to an information request made under section 1(1) of FOISA) if the processing is necessary for the purposes of legitimate interests pursued by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

85.There are, therefore, a number of different tests which must be satisfied before condition 6 can be met. These are:

• Does the applicant have a legitimate interest in obtaining this personal data?
• If yes, is the disclosure necessary to achieve these legitimate interests? In other words, is the disclosure proportionate as a means and fairly balanced as to ends, or could these legitimate interests be achieved by means which interfere less with the privacy of the data subject?

Even if the processing is necessary for the legitimate purposes of the applicant, would the disclosure nevertheless cause unwarranted prejudice to the rights and freedoms or legitimate interests of the data subject? This will involve a balancing exercise between the legitimate interests of the applicant and those of the data subject. Only if (or to the extent that) the legitimate interests of the applicant outweigh those of the data subject can the personal data be disclosed.

Does the applicant have a legitimate interest?

86.Professor Pollock submitted that it was necessary to know at least who the leading individuals were in order that PwC's experience in these types of projects could be verified.

87.The Commissioner has considered the arguments presented by Professor Pollock and is satisfied she has a legitimate interest, alongside the general public, in identifying individuals who have key responsibility for a contract with the Ministers which impacts heavily on public expenditure, irrespective of whether that individual works in the public or private sector.This information would allow an understanding of the level of seniority and experience of those responsible for delivering what is essentially a public service.

88.The Commissioner would draw a distinction here between key employees of PwC who are responsible for the contract delivery and whose experience would have an impact on the Ministers' consideration of the tender bid, and those who simply form part of the teams involved in service delivery (those who hold more junior roles within PwC).In this case, he would consider Professor Pollock's legitimate interests to extend to data relating to key senior employees, whose experience and role in the project is central to the provision of the relevant services, only.He is not satisfied that those interests can extend to data relating to more junior employees or to any individual's personal signature.

Is disclosure of the information necessary to achieve those legitimate interests?

89.The Commissioner must now consider whether disclosure of the information relating to the key senior employees is necessary for the purposes of the legitimate interests identified above. In this case the Commissioner, in taking account of the specific information requested by Professor Pollock, is satisfied that disclosure is necessary and proportionate, in that her aims cannot be achieved by any other means which would interfere less with the privacy of individuals in question.

Would disclosure cause unwarranted prejudice to the legitimate interests of the data subject?

90.The Commissioner must consider whether disclosure would nevertheless cause unwarranted prejudice to the rights, freedoms and legitimate interests of the key senior employees of PwC whose personal data have been requested and which the Commissioner has concluded Professor Pollock's legitimate interest extends to. As noted above, this will involve a balancing exercise between the legitimate interests of Professor Pollock and those of the individuals in question.Only if the legitimate interests of Professor Pollock outweigh those of the PwC employees can the information be disclosed without breaching the first data protection principle.

91.In the Commissioner's briefing on section 38 of FOISA, he notes a number of factors which should be taken into account in carrying out this balancing exercise.These include:

a) whether the information relates to the individual's public life (i.e. their work as a public official or employee) or their private life (i.e. their home, family, social life or finances);

b) the potential harm or distress that may be caused by the disclosure;

c) whether the individual has objected to the disclosure;

d) the reasonable expectations of the individuals as to whether the information would be disclosed.

92.As stated in previous decisions, generally the Commissioner will not consider it reasonable for senior professional employees of private firms who are involved in providing public authorities with key services to expect that their identities will remain out of the public domain. In the interests of transparency, it is hardly unreasonable that the identity of an individual in such a position be known.

93.In considering any prejudice to the rights, freedoms and legitimate interests of the data subjectsin this case (i.e. the senior the PwC employees in whose data he has recognised Professor Pollock has a legitimate interest) the Commissioner notes that this information was provided to the Ministers as a result of a tendering process.The Ministers submitted that none of the data subjects would have an expectation that information personal to their careers and education would be made publicly available.As they considered the only purpose of this information was to demonstrate to clients supporting capability to undertake the project, they did not believe there was any general public interest in disclosure.

94.Having considered the information withheld under section 38(1)(b), the Commissioner does not believe its disclosure would greatly diminish the privacy of the data subjects, particularly given that the information does not relate to their personal lives but to work done in performing a professional role.

95.In addition, as the data relating to these employees are conveyed in such a manner as to promote the capabilities of the employing organisation, essentially as a marketing tool in an attempt to win a public sector contract, the Commissioner is of the view that the key employees in question would have a reasonable expectation that their names, alongside their experience (all of which appears to involve only a limited intrusion on their private lives) would be disclosed in response to a request under FOISA.

96.In the Commissioner's view (see, for example, Decision 050/2008 Mr Q and the University of Glasgow) it is generally unreasonable for senior professional employees of private firms who are involved in providing public authorities with services such as this, involving significant public expenditure, to expect that their identities and key information relating to their skills and experience will remain outwith the public domain.It appears to him only reasonable in circumstances such as this for key senior employees of PwC to have an expectation, particularly following the advent of FOISA, that their information might be released as a result of winning and performing a public sector contract of this kind.

97.The Commissioner has therefore concluded that it would not, in this particular case, cause unwarranted prejudice to the rights and freedoms or legitimate interests of this group of data subjectsto disclose information about their identities, experience and role in service delivery.He is satisfied in the circumstances that any prejudice to their data subjects' rights and freedoms and legitimate interests is not unwarranted and is outweighed by the legitimate interests of Professor Pollock, as previously considered and identified in this decision notice.

98.Having found that condition 6 of schedule 2 of the DPA can be met for the information requested by Professor Pollock where it relates to the holders of these key senior employees of PwC, the Commissioner has gone on to consider whether (as required by the first data protection principle) disclosure would also be fair and lawful.The Commissioner considers that disclosure would be fair, for the reasons already outlined in relation to condition 6.The Ministers have put forward limited arguments as to why the disclosure of the information would be unlawful (other than in terms of a breach of the data protection principles), commenting that the personal details contained in the documentation had been supplied in the context of a contract tender and therefore in confidence.However, having considered the information in question, the Commissioner is not satisfied that it could be said to have been the subject of an obligation of confidentiality.

99.The Commissioner has accepted (see paragraph 32 above) that the inherent nature of the tendering process implies an obligation of confidentiality in respect of certain information provided in connection with a tender.This will not, however, extend to all information.The information under consideration here only extends only to details of personnel employed by PwC, which the Commissioner is satisfied can be distinguished in character from the other information he has already agreed is exempt under section 36(2) of FOISA.

100.As the Commissioner has previously noted, although the information was supplied in the context of a tender bid, the ITT makes it clear that information may be disclosed in response to a request under FOISA.He also has to note, as indicated above in his consideration of condition 6, that disclosure of this information would have been in the reasonable expectation of the data subjects.In these circumstances, he cannot accept that the information was provided to the Ministers under an implied obligation of confidentiality.It will also be clear from the Commissioner's analysis of section 36(2) of FOISA that it was not provided under an express obligation of confidentiality and therefore the Commissioner cannot, in the circumstances, accept that it was provided in confidence.

101.Having considered the submissions presented by the Ministers, therefore, the Commissioner has concluded that the disclosure under FOISA of the personal data of the key senior employees would not be unfair or unlawful.Having also concluded that condition 6 in Schedule 2 to the DPA could be met by its disclosure, he therefore cannot be satisfied that disclosure would breach the first data protection principle.

102.The Commissioner therefore finds that the exemption in section 38(1)(b) of FOISA should not be upheld in relation to the personal data of the key senior employees of PwC (who, for the sake of clarity are identified in the covering letter to the Ministers accompanying this decision notice), but that the Ministers were correct in their application of section 38(1)(b) to the remaining PwC employees whose personal data have been withheld.

Recent Court of Session Opinion

103.The Commissioner notes that the information request by Professor Pollock was for a copy of a document. In the case of Glasgow City Council and Dundee City Council v Scottish Information Commissioner [2009] CSIH 73, the Court of Session emphasised that FOISA gives a right to information, not documents. However, the Court also said, in paragraph 45 of its Opinion, that where a request refers to a document which may contain the relevant information, it may nonetheless be reasonably clear in the circumstances that it is the information recorded in the document that is relevant. The Court also said that if there is any doubt as to the information requested, or as to whether there is a valid request for information at all, the public authority can obtain clarification by performing its duty under section 15 of FOISA, which requires a public authority, so far as it is reasonable to expect it to do so, to provide advice and assistance to a person who proposes to make, or has made, a request for information to it.

104.In this case, the Commissioner notes that there is no indication in the correspondence he has seen between Professor Pollock and the Ministers that the Ministers questioned the validity of the information request. In addition, there is nothing to suggest from correspondence which the Ministers have subsequently had with the Commissioner that the Ministers were unclear as to what the information request sought.

105.The Commissioner is satisfied that the request is reasonably clear and that the information request is therefore valid.

DECISION

The Commissioner finds that the Scottish Ministers (the Ministers) partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Professor Pollock.

The Commissioner finds that the Ministers were correct in their application of section 38(1)(b) to details of some PwC employees, section 36(2) to details of referees and key details of PwC's methodology (i.e. resources allocation) and 33(1)(b) to pricing structures.

However, by incorrectly applying section 38(1)(b) to the personal data of key staff members responsible for the delivery of the service (as identified in the letter to the Ministers accompanying this decision notice) and sections 36(2), 33(1)(b) and 33(2)(b) to details of previous clients and project engagement descriptions, the Ministers failed to comply with Part 1, and in particular section 1(1), of FOISA.

The Commissioner therefore requires the Ministers to provide Professor Pollock with the information he has found to have been withheld incorrectly, by 2 February 2010.

Appeal

Should either Professor Pollock or the Scottish Ministers wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only.Any such appeal must be made within 42 days after the date of intimation of this decision notice.

Kevin Dunion
Scottish Information Commissioner
17 December 2009

Appendix

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

?

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that ?

(a) the provision does not confer absolute exemption; and

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

(2) For the purposes of paragraph (a) of subsection 1, the following provisions of Part 2 (and no others) are to be regarded as conferring absolute exemption ?

?

(c) section 36(2);

?

(e) in subsection (1) of section 38 ?

?

(ii) paragraph (b) where the first condition referred to in that paragraph is satisfied by virtue of subsection (2)(a)(i) or (b) of that section.

33 Commercial interests and the economy

(1) Information is exempt information if-

?

(b) its disclosure under this Act would, or would be likely to, prejudice substantially the commercial interests of any person (including, without prejudice to that generality, a Scottish public authority).

(2)Information is exempt information if its disclosure under this Act would, or would be likely to, prejudice substantially ?

?

(b)the financial interests of an administration in the United Kingdom;

?

36 Confidentiality

?

(2) Information is exempt information if-

(a) it was obtained by a Scottish public authority from another person (including another such authority); and

(b) its disclosure by the authority so obtaining it to the public (otherwise than under this Act) would constitute a breach of confidence actionable by that person or any other person.

38 Personal information

(1) Information is exempt information if it constitutes-

?

(b) personal data and either the condition mentioned in subsection (2) (the "first condition") or that mentioned in subsection (3) (the "second condition") is satisfied;

?

(2) The first condition is-

(a) in a case where the information falls within any of paragraphs (a) to (d) of the definition of "data" in section 1(1) of the Data Protection Act 1998 (c.29), that the disclosure of the information to a member of the public otherwise than under this Act would contravene-

(i) any of the data protection principles; or

?

(b) in any other case, that such disclosure would contravene any of the data protection principles if the exemptions in section 33A(1) of that Act (which relate to manual data held) were disregarded.

?.

(5) In this section-

"the data protection principles" means the principles set out in Part I of Schedule 1 to that Act, as read subject to Part II of that Schedule and to section 27(1) of that Act;

"data subject" and "personal data" have the meanings respectively assigned to those terms by section 1(1) of that Act;

?.

Data Protection Act 1998

1 Basic interpretative provisions

(1)In this Act, unless the context otherwise requires ?

?

"personal data" means data which relate to a living individual who can be identified ?

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

?

Schedule 1 ? The data protection principles

Part I ? The principles

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless ?

(a) at least one of the conditions in Schedule 2 is met, and

(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.

Schedule 2 ? Conditions relevant for purposes of the first principle: processing of any personal data

...

6. (1) The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

?